craft-4bbbbe — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited craft-4bbbbe (Agent Skill) and scored it 96/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 1 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 1 flagged
The text {match} tells the agent to skip the normal "ask the user first" gate. Used adversarially it removes the human-in-the-loop check before destructive or sensitive actions, turning a normally-gated agent into a fire-and-forget executor.
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
<!-- AUTO-GENERATED. Do not edit here. Source: skills/ui-craft/ + commands/*.md. Regenerate with node scripts/sync-harnesses.mjs. -->
Context: this sub-skill is one lens of the broader ui-craft skill. If the ui-craft skill is also installed, read its SKILL.md first for Discovery + Anti-Slop + Craft Test, then apply the specific lens below.
Load the ui-craft skill. This command BUILDS — it ends with working code that passes the recipe's acceptance bar.
Recipes available: dashboard → references/recipe-dashboard.md · landing → references/recipe-landing.md · auth (sign-in/sign-up) → references/recipe-auth.md. If the target the user described names a surface with no recipe yet (settings, docs, e-commerce), say so and fall back to standard Build mode with the closest references — do not improvise a fake recipe.
Before anything else: if .ui-craft/spec.md exists and contains a ## Surface: <name> section whose name matches the target the user described, load that section now. Its chosen composition, component inventory, state lattice, and acceptance bar take precedence over the recipe defaults for all downstream steps. Note which acceptance bar items came from the spec vs. recipe defaults.
Run Stack Detection + Discovery Step 1 (existing tokens, .ui-craft/brief.md).
Ask the recipe's Step 0 questions in ONE compact prompt, pre-filling anything the target the user described or the brief already answers. If the user declines, says "you decide", or has answered before in this session: apply the recipe defaults silently and say which were applied. Never ask twice; never block.
From the answers: composition + theme preset (or existing tokens) + density. Print a 5-line plan — composition name, hero metric, theme, what's above the fold, what's deferred below — and proceed without waiting unless the user objects.
Follow the recipe's Build order EXACTLY (tokens → shell → hero tier → primary region → remaining tiers → states → keyboard → finish). Load the references each step names. States and keyboard are build steps, not polish — a surface without empty/loading/error states is not done.
Run the recipe's acceptance checklist against the built surface. Fix every unchecked item before reporting — the bar is the definition of done, not a suggestion. Then report: checklist results, the one signature detail included, and any item the user explicitly waived.
At CRAFT_LEVEL ≥ 8, finish with the full /finalize gate instead of the recipe's minimum passes.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.